AQA · GCSE · Computer Science
Course version: 8525 · Version from Sept 2020
Using email confirmations to confirm a user’s identity
Full specification wording
Methods to detect and prevent cyber security threats: using email confirmations to confirm a user’s identity
Email confirmation verifies that a person controls the email address linked to an account.
Checked against the AQA 8525 specification (opens in a new tab) on .
- Point 4 of 5
Study notes
From the checked teaching notes for this specification point.
The idea
Email confirmation verifies that a person controls the email address linked to an account. During registration or a sensitive change, the system sends a message containing a unique link or code to that address. The user must open the email and follow the link or enter the code before the account is activated or the change is accepted. Because only someone with access to that inbox can complete the step, it gives evidence that the user is genuine and reduces fake or automated account creation. It also supports account recovery and can alert a real owner to unauthorised changes. It is a prevention and detection measure: it blocks accounts created with false addresses and reveals suspicious activity. It confirms control of an email address, not a legal identity, and is weaker if the inbox itself is compromised.
What earns the marks
- Explains that the system sends a unique link or code to the email address supplied by the user.
- States that the user must open the email and follow the link or enter the code to activate the account or confirm the change.
- Explains that success shows the user controls that email inbox, providing evidence the user is genuine.
- Links the method to preventing fake or automated account creation and to detecting unauthorised changes.
- Recognises the limitation that it confirms control of an email address rather than a legal identity.
Common mistakes and how to put them right
Claiming email confirmation proves the user's real name or legal identity.
Put it right: It only shows control of the email inbox.
Thinking the confirmation happens automatically without user action.
Put it right: The user must open the email and follow the link or enter the code.
Confusing email confirmation with CAPTCHA.
Put it right: CAPTCHA tests for a human, whereas email confirmation tests access to a specific inbox.
Exam tips
- Describe the full sequence: send link or code, user opens email, user confirms, account activated.
- State what the confirmation proves (control of the inbox) and what it does not prove (legal identity).
- Link the method to a concrete threat, such as mass creation of fake accounts, to show its purpose.
Try the lesson
The start of the Methods to detect and prevent cyber security threats: using email confirmations to confirm a user’s identity lesson, made from checked teaching notes for this specification point.
Have a go first
When a user signs up for an account, the site sends a message containing a link that must be clicked before the account becomes active. What does this email confirmation check?
There is more to this lesson
The full lesson goes on to check your understanding and help you earn the marks. Create a free account to carry on, with your progress saved.
A week of Premium from your first lesson · Then the free plan continues · No card, no charge
Test your understanding of Methods to detect and prevent cyber security threats: using email confirmations to confirm a user’s identity
Active recall beats re-reading. Take an instant quiz now to test what you’ve learned and lock it into long-term memory.
A week of Premium from your first lesson · Then the free plan continues · No card, no charge